Spring Boot Attack Probe

Spring Boot Attack Probe

Authorized probe of a Spring Boot 3.x app the user owns. Follow shared probing conventions — discover base URL from application.{properties,yml} server.port (default 8080), Dockerfile EXPOSE, or docker-compose.yml. Never hardcode.

Spring-specific attack surface

• Actuator endpoints under /actuator/* are gold mines: /env (env vars including secrets), /heapdump (full heap → JWT secrets), /loggers (POST to change log level → log injection), /configprops, /threaddump. Easy to expose via management.endpoints.web.exposure.include=*.
• /h2-console is enabled in dev profile — any process with HTTP access can run SQL via JDBC URL pointing back to the app's DB.
• Whitelabel error page discloses package/class names and Spring version.
• Mass-assignment via @ModelAttribute: extra form fields auto-bind to entity fields including id, roles unless setAllowedFields is restricted.
• @RequestParam type coercion + missing @PreAuthorize = "everyone is the admin user" via ?userId=1.

Procedure

1. Authorization preflight + base URL discovery.
2. Liveness: GET /, GET /actuator.
3. Run rules. Several Actuator endpoints are read-only; some (/loggers, /env) accept POSTs — never write to non-test environments.

Rules

Important: heap-dump handling

If SB-ACT-003 returns a heap dump:

1. Do not download more than the first 1MB.
2. Do not parse it yourself for credentials.
3. Surface the finding immediately and ask the user whether to retain or discard the partial download.

Wrong vs. right

SB-ACT-001 (Actuator wide open)

# ❌ application.yml
management:
  endpoints:
    web:
      exposure:
        include: "*"

# ✅
management:
  endpoints:
    web:
      exposure:
        include: health, info        # only what you actually need
  endpoint:
    health:
      show-details: when-authorized

// ✅ separate filter chain for actuator
@Bean
@Order(1)
SecurityFilterChain actuator(HttpSecurity http) throws Exception {
  http.securityMatcher("/actuator/**")
      .authorizeHttpRequests(a -> a.anyRequest().hasRole("ACTUATOR"))
      .httpBasic(withDefaults());
  return http.build();
}

SB-MA-001 (mass-assignment)

// ❌
@PostMapping("/users")
public User create(@ModelAttribute User user) { return repo.save(user); }

// ✅ DTO + explicit mapping
public record CreateUserDto(@NotBlank String email, @NotBlank String name) {}

@PostMapping("/users")
public User create(@Valid @RequestBody CreateUserDto dto) {
  var u = new User(); u.setEmail(dto.email()); u.setName(dto.name());
  return repo.save(u);
}

References

• Spring Boot Actuator: https://docs.spring.io/spring-boot/docs/current/reference/html/actuator.html
• Actuator security: https://docs.spring.io/spring-boot/docs/current/reference/html/actuator.html#actuator.endpoints.security
• Spring Security: https://docs.spring.io/spring-security/reference/index.html
• CVE database (filter spring-projects): https://www.cve.org/